Claude cracks 25-year cryptography mystery

What Claude is said to have solved

Anthropic’s Frontier Red Team published a research note on October 16, 2026 saying Claude had identified the origin of seed values used in major NIST elliptic curves for ECDSA, a digital-signature standard widely used to authenticate messages, software and transactions [1]. The short version is almost anticlimactic: the seeds for NIST P-192, P-224, P-256, P-384 and P-521 were not hashes of a hidden joke phrase, but outputs of lrand48, a 1990s-era C library pseudorandom-number generator initialized with Unix timestamps [1].

That claim matters because the curves were standardized in 2000 with numbers supplied by the NSA, but without a public derivation that fully explained where the seeds came from [2]. In cryptography, unexplained constants can become political objects as much as mathematical ones: if no one can tell how a parameter was chosen, skeptics ask whether it was selected for a hidden property. Anthropic’s result does not prove every historical choice was innocent, but it replaces one large unknown with a reproducible recipe [1].

Anthropic says the model reached the answer in under half an hour after an employee asked an internal research model to determine the seed-generation process without steering it toward the older passphrase rumor [1]. Investing.com’s report framed the result as a decades-old mystery around cryptographic standards being traced to “a simple random-number generator seeded with timestamps” [2].

The method: from suspicious bits to timestamps

The interesting part is not that a model guessed lrand48; it is how the guess became checkable. Anthropic says Claude approached the problem by asking what kind of software, likely written in the late 1990s, could have generated the published values [1]. It wrote a scanner that moved across each seed bit by bit and tested whether neighboring chunks looked like consecutive outputs from vintage pseudorandom generators [1].

One pattern stood out. In several seeds, the top bits were consistently zero when the data was viewed as 32-bit words, a signature compatible with lrand48, which returns only the top 31 bits of a 48-bit internal state [1]. For four seeds, Claude could brute-force hidden bits and verify that later words followed the same generator state [1]. For the prime-curve seeds, where fewer bits were retained, Anthropic says Claude used the Lenstra–Lenstra–Lovász lattice-reduction algorithm to reconstruct truncated linear-congruential-generator states [1].

The reported match is strong because the recovered 48-bit states regenerate the full 160-bit seed values, rather than merely resembling them [1]. Anthropic says five NIST prime-curve seeds and five ANSI X9.62 seeds follow the same pattern, specifically lrand48() >> 23 [1]. Blockchain.News separately summarized the P-256 example as matching candidate 1,842 from a run starting at 1997-08-16 01:52:34 UTC [4].

After recovering generator states, Claude ran the linear generator backward to states consistent with srand48, whose initialization form includes low 16 bits equal to 0x330E [1]. For the ten prime-curve seeds, Anthropic says those initializations corresponded to Unix timestamps between May 1997 and April 1998 [1]. For four binary-curve initializations, the direct dates appeared as February 1984, but doubling the timestamp mapped them to April 17, 1998, leading Anthropic to suggest the generating program may have halved the clock value [1].

Why this reduces, but does not erase, backdoor anxiety

Anthropic is careful on one point: this is not a cryptographic break, not a new attack, and not a reason for users to change systems [1]. The company argues that a mundane, reproducible generator makes a deliberate backdoor less plausible because the seed-generation process leaves less room for secret selection [1]. Unite.AI’s write-up echoes that framing, saying the discovery points away from a hidden passphrase or deliberate subversion and toward a clock-seeded generator [3].

Still, “less plausible” is not the same as “logically impossible.” Anthropic itself says some viable candidate curves appear to have been skipped [1]. For P-256, the published seed was candidate 1,842, yet candidate 876 from the same run also appears to have produced a valid prime-order curve of the expected size [1]. P-224 and two ANSI example runs also skipped additional viable candidates, and Anthropic says it does not know what selection criteria were used [1].

That gap is where the cautious reading belongs. Models at Work noted that the result remains vendor research and has not been independently reviewed, while also pointing out a critical objection: if someone had searched timestamps until a desired property appeared, a timestamp-based derivation might look innocuous after the fact [5]. Anthropic argues that such a scenario is not plausible given the small number of skipped candidates, because it would imply weakened curves were common and easy to find [1]. But for cryptographers, “implausible” still invites reproduction, peer review and adversarial checking.

Base points: a second partial win

Claude also reportedly found the origin of some base points, the fixed generator points used in ECDSA arithmetic [1]. The seed determines a curve coefficient, but it does not determine the base point, so this was a separate provenance problem [1].

Anthropic says the base points for six curves generated in May 1997 — P-192 and the ANSI X9.62 example curves prime192v2, prime192v3 and prime239v1 through prime239v3 — trace to a random-number routine in Arjen Lenstra’s FreeLIP long-integer package, code that also shipped in early versions of Victor Shoup’s NTL library [1]. The recipe involved seeding the generator with a small integer, discarding seven outputs, generating candidate x-coordinates from 26-bit outputs reduced modulo p, and repeating until the x value lay on the curve [1].

The matched integer seeds include 20000 for P-192 and 20420, 20507, 20509, 20512 and 20517 for the ANSI example curves [1]. Anthropic says it does not know how the base points for P-224, P-256, P-384 and P-521 were selected, and the same uncertainty remains for NIST binary curves [1].

What remains open

The most important unresolved item is B-163, the fifth binary seed, which Anthropic says “fits nothing Claude has tried” [1]. Also unresolved are the skipped viable candidates and the unexplained base points of four major NIST prime curves [1]. These caveats do not undo the central result, but they define the work still needed before the community treats the case as closed.

The bounty is another useful signal. Anthropic says the $36,864 award for finding the seeds will be donated to the Internet Security Research Group [1]. That choice underlines the public-interest character of the work, but it does not substitute for independent validation.

Why it matters for AI research

This episode is a sharper demonstration than a benchmark score because it combines hypothesis generation, code writing, computation and skepticism. Claude did not merely answer a trivia question; according to Anthropic, it generated and tested a method against public cryptographic constants [1]. The best lesson is not that AI can “do cryptography” in a blanket sense, but that frontier models may become useful research collaborators when their claims collapse into reproducible artifacts.

The industry should therefore watch the commit hash, the reproduction code, third-party checks and any follow-up from cryptographers more closely than the 30-minute headline. If the result holds, Claude has helped settle a 25-year mystery. If parts of it fail under review, the failure will still teach the field how to audit AI-assisted discoveries. Either way, Alan Turing would probably ask for the exact script before applauding.

Sources from the last 72 hours

1. [1]Claude reveals ECDSA curve originsOct 16, 2026, 2:00 AM
2. [2]Anthropic says Claude solved 25-year cryptography mystery in 30 minutesOct 16, 2026, 4:53 PM
3. [3]Anthropic Says Claude Traced NIST ECDSA Curve Seeds to a 1990S RNGOct 16, 2026, 2:00 AM
4. [4]Claude traces the origins of NIST ECDSA curve seedsOct 16, 2026, 9:07 PM
5. [5]Anthropic says Claude traced NIST curve seeds to a 1990s random generatorOct 16, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.